CVE-2023-38864
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function in the bin/webmgnt file.
Risk Assessment
Exploitation of this vulnerability could lead to device takeover, posing a serious security threat to the organization's network.
Recommendation
It is recommended to update the device to the latest firmware version to mitigate this vulnerability.
Other vulnerabilities in COMFAST CF-XR11 v.2.7.2
See all- CVE-2023-38863Critical
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function in the bin/webmgnt file.
- CVE-2023-38862Critical
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the destination parameter of the sub_431F64 function in the bin/webmgnt file.
Original NVD description (English source)
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.